Skip to main content
Glama

Run Governance 360 Loop

governance_360
Read-onlyIdempotent

Verify publisher governance on HTML pages: check signature, content hash, and usage terms, then create a signed access receipt for agent compliance.

Instructions

Execute the full governance 360 loop on HTML content: extract governance block → verify signature + content hash → check usage terms → create signed access receipt. This is what an agent calls on every page it reads.

Input Schema

NameRequiredDescriptionDefault
htmlYesFull HTML of the page
sourceUrlYesURL of the page
contentBodyYesArticle text content (for hash verification)
intendedUsageYes
agentPublicKeyYesYour agent's Ed25519 public key (hex)
agentPrivateKeyYesYour agent's Ed25519 private key (hex)
publisherPublicKeyYesPublisher's Ed25519 public key (hex)

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv4.0.0
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
    • removedInput schema / additionalProperties
      Removed value: -false
  2. Addedv2.8.0

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, destructive=false and closed-world, so the safety profile is given. The description adds the pipeline and implies secret-key use ("signed access receipt" with agentPrivateKey), but says nothing about failure semantics: what happens if the signature or content hash fails, or whether a partial result is returned. There is mild tension between "create signed access receipt" and readOnlyHint=true, though a returned receipt need not mutate state, so this is not a contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the operation and followed by a compact pipeline arrow-list, with zero filler. Could be trimmed slightly but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-required-parameter composite with no output schema, the description covers the flow but omits the return shape of the receipt and the behavior on verification failure — the two things an agent most needs before calling it on "every page." Adequate, but with a clear gap given the absence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 86%, so the schema already documents inputs; baseline 3 applies. The description implicitly maps steps to inputs (html → extract block, contentBody/publisherPublicKey → hash/signature verification, intendedUsage → usage terms), but adds no format, key, or edge-case detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Execute the full governance 360 loop") and then enumerates the four sub-steps, so the agent knows this is a composite operation. That composite framing also distinguishes it from the single-step siblings (verify_governance_block, check_usage_permitted, create_access_receipt) that would otherwise look like alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"This is what an agent calls on every page it reads" gives an explicit, memorable trigger condition. It does not, however, name when NOT to use it or which siblings to call instead (e.g., verify_governance_block when no receipt is needed), so the routing guidance is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools